DbgkUserReportWorkRoutine

INT64 __stdcall DbgkUserReportWorkRoutine(PVOID P){
  __int64 v2; 
  _KPROCESS *v3; 
  NTSTATUS v4; 
  char *v5; 
  NTSTATUS v6; 
  INT64 result; 
  POBJECT_TYPE ObjectType; 
  UINT64 AccessMode; 
  PVOID BaseAddress; 
  HANDLE ThreadHandle; 
  HANDLE Handle; 
  ULONG_PTR RegionSize[3]; 
  __int128 v14; 
  __int128 v15; 
  __int128 v16; 
  _KAPC_STATE ApcState; 
  RegionSize[2] = (ULONG_PTR)P;
  Handle = 0i64;
  ThreadHandle = 0i64;
  BaseAddress = 0i64;
  RegionSize[0] = 168i64;
  memset(&ApcState, 0, sizeof(ApcState));
  v14 = 0i64;
  v15 = 0i64;
  v16 = 0i64;
  v2 = *(_QWORD *)P;
  RegionSize[1] = v2;
  IoThreadToProcess((_ETHREAD *)v2);
  KiStackAttachProcess((_KPROCESS *)v3, 0i64, &ApcState);
  v4 = ObOpenObjectByPointer((PVOID)v2, 0, 0i64, 0x72u, (POBJECT_TYPE)PsThreadType, 1, &Handle);
  if( v4 >= 0 )
  {
    LODWORD(AccessMode) = 4;
    LODWORD(ObjectType) = 12288;
    v4 = ZwAllocateVirtualMemory(
           (PVOID)0xFFFFFFFFFFFFFFFFi64,
           &BaseAddress,
           0i64,
           RegionSize,
           (UINT64)ObjectType,
           AccessMode);
    if( v4 >= 0 )
    {
      *((_QWORD *)BaseAddress + 1) = *((_QWORD *)P + 1);
      *(_QWORD *)BaseAddress = Handle;
      if( *((_BYTE *)P + 16) )
      {
        v5 = (char *)BaseAddress + 16;
        *((_OWORD *)BaseAddress + 1) = *(_OWORD *)((char *)P + 24);
        *((_OWORD *)v5 + 1) = *(_OWORD *)((char *)P + 40);
        *((_OWORD *)v5 + 2) = *(_OWORD *)((char *)P + 56);
        *((_OWORD *)v5 + 3) = *(_OWORD *)((char *)P + 72);
        *((_OWORD *)v5 + 4) = *(_OWORD *)((char *)P + 88);
        *((_OWORD *)v5 + 5) = *(_OWORD *)((char *)P + 104);
        *((_OWORD *)v5 + 6) = *(_OWORD *)((char *)P + 120);
        *((_OWORD *)v5 + 7) = *(_OWORD *)((char *)P + 136);
        *((_OWORD *)v5 + 8) = *(_OWORD *)((char *)P + 152);
        *((_QWORD *)v5 + 18) = *((_QWORD *)P + 21);
      }
      LODWORD(v14) = 48;
      *((_QWORD *)&v14 + 1) = 0i64;
      DWORD2(v15) = 512;
      *(_QWORD *)&v15 = 0i64;
      v16 = 0i64;
      ZwCreateThreadEx(&ThreadHandle);
      v4 = v6;
    }
    else
    {
      BaseAddress = 0i64;
    }
  }
  if( v4 < 0 )
  {
    _InterlockedAnd((volatile signed __int32 *)(v2 + 1296), 0xFFDFFFFF);
    if( Handle )
      ObCloseHandle(Handle, 1);
    PsResumeThread(v2, 0i64);
    if( BaseAddress )
      ZwFreeVirtualMemory((PVOID)0xFFFFFFFFFFFFFFFFi64, &BaseAddress, 0i64, 0x8000ui64);
  }
  else
  {
    ZwSetInformationThread(ThreadHandle, ThreadPriorityBoost|0x20, &qword_140033510, 4ui64);
    ZwResumeThread(ThreadHandle, 0i64);
    ZwClose(ThreadHandle);
    ThreadHandle = 0i64;
  }
  KiUnstackDetachProcess(&ApcState, 0i64);
  ExFreePoolWithTag(P, 0x4B474244u);
  HalPutDmaAdapter((PADAPTER_OBJECT)v2);
  return result;
}

Referenced by: